Tenant isolation
Every domain table carries a workspace id. Queries are workspace-scoped. Platform administration is a separate identity realm with its own MFA-backed sessions.
Trust and legal
Security you can send to an owner.
Tenant isolation, encrypted secrets, human-confirmed assistant actions, and backups. We do not train models on your schedules. This page is an operational draft, not legal advice.
Last updated: 2026-08-20.
This page is provided for product transparency and operational review. It is not legal advice. Counsel has not signed the operational drafts.
Sessions
Tenant sessions are HttpOnly cookies after login. Platform sessions are opaque cookies with CSRF, idle and absolute expiry. Support tokens are re-checked live.
Encryption
Import credentials and MFA secrets are AES-256-GCM encrypted at rest. Interview PII uses a dedicated key when interviews are enabled. Recovery codes are stored hashed.
We do not train on your week
Workspace schedules and assistant transcripts are not used to train third-party models. Taylor has no database credentials. The model only talks.
Backups
Production Postgres is dumped, encrypted with age, and stored off-host. Restore drill notes live in the operations docs.
Subprocessors
Hosting, email, SMS, and optional AI providers are listed on Subprocessors. SMS details also sit on SMS privacy.
Security model
schedule.site is multi-tenant. Domain tables are workspace-scoped, authenticated routes enforce tenant roles, and platform administration uses a separate identity realm from tenant users.
Authentication
Tenant sessions use secure authentication controls, role middleware, email verification, and account status checks. Optional TOTP and passkeys are available. Platform administration uses separate MFA-protected sessions and live support-session validation.
Assistant safety
Taylor does not receive database credentials. Deterministic server-side services authorize and execute scheduling actions, with confirmation flows for consequential tasks and audit records for mutations. Video-interview AI may only transcribe and summarize; hiring decisions stay human.
Data protection
Import credentials are encrypted with AES-256-GCM using workspace context as associated data. Sensitive credentials are not returned by the API and are purged after extraction.
Operational controls
Production startup validation rejects weak secrets, bad origins, and unsafe demo flags. Authenticated mutations are audited, and high-risk public surfaces use rate limits and request-size controls.
Contact
Security questions and vulnerability reports: support@schedule.site. Do not access other customers' data while reporting.
Responsible disclosure
If you believe you found a vulnerability, do not access other customers' data. Report the issue with reproduction details through the support channel in your account.